Delete OEM drivers (to enable memory integrity)

On Windows 10/11 when memory integrity cannot be switched on due to incompatible drivers, you can use pnputil.exe to remove the affected OEM drivers

Open Windows Security

Select Device Security

Select the Core isolation details

Set the slider to ON to enable core isolation

If any incompatible (old) drivers are on the system, you will get this:

Select ‘Review incompatible drivers’

Driver example: apg8201zx64.sys (ACS smart card reader driver) – expand the driver to display the oem##.inf

Open an elevated command prompt & run

pnputil.exe /delete-driver oem##.inf

Once successfully removed press the ‘Scan Again’ button in the Windows Security app

If no more incompatible drivers are found you will be able to use core isolation (after a restart)

Reboot the device & verify the setting is now on

Troubleshooting tips:

In case you run in to an exception causing your device to bluescreen after turning on this option, you can reboot into safe mode & run this command to turn it off again:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f